GHSA-2p6r-37p9-89p2
Authz Module Non-Determinism
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/cosmos/cosmos-sdk | >= 0.43.0, < 0.44.2 | 0.44.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Consensus failure for 0.43.x and 0.44.{0,1} users.
Funds and balances are safe.
### Patches
0.44.2
### Workarounds
Manually patch the code.
---
Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2p6r-37p9-89p2
- https://nvd.nist.gov/vuln/detail/CVE-2021-41135
- https://github.com/cosmos/cosmos-sdk/commit/68ab790a761e80d3674f821794cf18ccbfed45ee
- https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349
- https://github.com/cosmos/cosmos-sdk
- https://github.com/cosmos/cosmos-sdk/releases/tag/v0.44.2